diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index a37afabb0f00..95acf8df69a8 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -45,6 +45,7 @@ #include "util-time.h" #include "util-validate.h" #include "util-conf.h" +#include "detect-flowbits.h" static int rule_warnings_only = 0; @@ -861,6 +862,38 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData * jb_close(js); break; } + case DETECT_FLOWBITS: { + const DetectFlowbitsData *cd = (const DetectFlowbitsData *)smd->ctx; + + jb_open_object(js, "flowbits"); + jb_set_uint(js, "idx", cd->idx); + jb_set_uint(js, "or_list_size", cd->or_list_size); + jb_set_uint(js, "or_list", cd->or_list); + if (cd->or_list_size > 0) + jb_set_string(js, "name", cd->or_list[cd->idx]); + switch (cd->cmd) { + case DETECT_FLOWBITS_CMD_NOALERT: + jb_set_string(js, "cmd", "noalert"); + break; + case DETECT_FLOWBITS_CMD_ISSET: + jb_set_string(js, "cmd", "isset"); + break; + case DETECT_FLOWBITS_CMD_ISNOTSET: + jb_set_string(js, "cmd", "isnotset"); + break; + case DETECT_FLOWBITS_CMD_SET: + jb_set_string(js, "cmd", "set"); + break; + case DETECT_FLOWBITS_CMD_UNSET: + jb_set_string(js, "cmd", "unset"); + break; + case DETECT_FLOWBITS_CMD_TOGGLE: + jb_set_string(js, "cmd", "toggle"); + break; + } + jb_close(js); + break; + } } jb_close(js);